Scope control
Limitations
- Does not establish the value, rotation, transport, or enforcement of secrets on the actual host.
Institutional evidence record
EVI-INST-0011
Browser forms use a CSRF boundary in source
The packaged contact form and application stack include CSRF protection when the Flask application is running with required configuration.
Source and verification
Full bounded record
- Claim ID
- EVI-INST-0011
- Claim class
- REPOSITORY VERIFIABLE
- Status
- SUPPORTED WITHIN SCOPE
- Institutional page
- Security
- Source type
- REPOSITORY SOURCE
- Source release
- 2.0.0-rc.57-WIP
- Source path or public URL
app/forms.py- Source digest
- a29d2d47aee0e53ffae02b821dbfcd1af83b8bfa0c90fa59e58293c251a01635
- Observation environment
- RC57 source tree
- Observation time
- 2026-08-13T00:47:38Z
- Verification method
- Form and extension configuration inspection
- Verification result
- CSRF-enabled form path present
- Scope
- Packaged application source
- Change event
- EV-CHG-0056-007
- Public record URL
- https://evulgare.com/institutional/evidence/EVI-INST-0011/
Review triggers
Known defeaters
- Misconfiguration, disabled extension, mixed deployment, or route bypass.
Append-oriented lineage
Change history
Material claim changes are added as events. A correction, qualification, withdrawal, supersession, restoration, or stale marker should not silently erase the earlier state.
-
ADD EV-CHG-0056-007
The security page separates source control from deployed-host state.
- Reason
- Document repository-supported browser-form security controls.
- Previous state
- Security page did not identify the bounded CSRF source fact
- New state
- CSRF source fact published with deployment limitation
- Review boundary
- Source implementation, not actual-host enforcement
- Source record
app/forms.py
Machine-readable record
Inspect the bounded JSON representation
The JSON endpoint contains the same public fields and change events. It does not add evidentiary weight or expand the record beyond this declared scope.
Open record JSON